Danesgate PRU City of York Council Internal Audit Report 2019/20

Headteacher: P Head Date Issued: 12/02/20 Status: Final Reference: 15693/001

| | P1 | P2 | P3 | |---|----|----|----| | Actions | 0 | 4 | 7 | | Overall Audit Opinion | Limited Assurance | Summary and Overall Conclusions

Introduction This audit has been carried out as part of the Internal Audit plan for Children, Education and Communities for 2019/20. Schools are audited in accordance with a detailed risk assessment.

Objectives and Scope of the Audit The purpose of this audit was to provide assurance to Governors, the Headteacher and management that procedures and controls in the areas listed below are working adequately and are well controlled.

The audit reviewed processes and transactions in the following areas:

- Governance and Financial Management
- System Reconciliation
- Banking Arrangements
- Contracts, Purchasing and Authorisation
- Income
- Capital and Property
- Extended Schools Provision
- Human Resources
- Payroll and Staff Costs
- School Meals
- Pupil Numbers
- School Fund
- Data Protection and Information technology
- Insurance and Risk Management
- Joint Use Facilities
- Inventories
- Safeguarding

Key Findings The PRU is not in a deficit position financially and balances seem reasonable and consistent. However, it was found that budget monitoring reports had not been evidenced as presented to Governors during the spring term for the 18/19 budget or during the summer term for the 19/20... budget (the minimum frequency required in the Budget Management Policy is termly) therefore effective scrutiny by the Governors could not be confirmed. Additionally, the budget monitoring reports produced for Governors were in a format reporting actual expenditure but only expected funding for the current year, without a supporting report produced directly from the financial management system to confirm actual balances. There was also no evidence of regular scrutiny by the Head and Business Manager. It is suggested that monitoring reports are produced at more frequent intervals (at least twice per term) and signed by both officers. Agreement of the start budget for 2019/20 was delayed significantly due to questions raised on the budgetary position for 18/19 and in particular in relation to advance funding received from the LA which was not reported to Governors until year end. It is acknowledged however that there appeared to be delays by the LA in responding to these queries.

Routine monthly financial checks had not been completed for the current financial year. This included the bank reconciliations which are required to be submitted as a return to the LA. The PRU relays heavily on the use of agency and supply staff and good procedures were in place to ensure agency charges were accurate but financial checks on salary and supply charges made through CYC had not been completed.

Invoiced charges made to Academies and out of area schools for places at the PRU had not always been raised promptly and chasing of overdue invoices had not been completed on a regular basis for the current financial year. At the time of the audit the PRU had approximately £43K in outstanding debts. The majority of the debt had been outstanding in excess of 12 months and related to one Academy (where there was a dispute over liability for charges). Evidence of previous attempts to resolve this debt were seen at the audit.

The schedule of policies (identifying the policies held by the school, the date of approval and the date they are scheduled for review) had not been kept up to date and a number of policies that were required did not appear to be held by the PRU.

Recruitment checks were reviewed and evidence was found of completion. However, reference requests (issued before a job offer was made) ask for information concerning health related absences and should be replaced by with the pro-forma included in the HR Policy. In addition, it was found that DBS certificates have been held on personal files for longer than allowable under GDPR regulations.

There was no up to date schedule of contractual arrangements maintained by the PRU or procedures in place to ensure contractors directly commissioned to carry out works have sufficient insurance in place.

Additionally, some minor issues were identified and discussed in relation to evidencing independent checking of procurement card statements and some errors in the claims for top up funding for 18/19 (which had been accounted for in the calculation of funding received from the Local Authority).

**Overall Conclusions**

It was found that the arrangements for managing risk were poor with significant control weaknesses in key areas and major improvements required before an effective control environment will be in operation. Our overall opinion of the controls within the system at the time of the audit was that they provided Limited Assurance. 1 Policies

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | Some policies required by the schools did not appear to be in place. | Policies may not be the current version and may not reflect current regulations or the requirements of the Governors. | | Additionally it was not clear whether policies were the most up to date versions and had been approved by Governors. | |

Findings

The schedule of policies recording the last date of approval and the due date for review had not been kept up to date. A copy of the latest approved policy is not routinely signed by the Chair of Governors and held on file by the school.

Additionally, the following policies did not appear to have been adopted by the PRU.

- Data Protection and Information Policy
- CCTV Policy
- School Visits Policy
- Debt Management Policy

Recommendation

The schedule of policies should be reviewed and updated and used to evidence that policies are scheduled for review as appropriate. A copy of approved policies should be signed by the chair of Governors and held on file. The identified policies, if not in place, should be adopted by the PRU.

Agreed Action 1.1

The recommended action will be implemented. The policies listed above will be scheduled for review and approval between now and February 2020.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Head Teacher and Clerk to Governors | 28.2.20 | 2 Financial Management

| Issue/Control Weakness | Risk | |------------------------|------| | Minutes of the Management Committee did not evidence that Governors have scrutinised the budget position on a termly (or more frequent) basis in accordance with the Budget Management Policy. Monitoring reports issued to Governors are not produced directly from the finance system and may not reflect the true financial position of the PRU. | Governors are not providing scrutiny and challenge in relation to the budget and overspends may occur. |

Findings

The PRU no longer has a separate Finance Committee, but deals with financial issues through the full Management Committee. The terms of reference of the Management Committee stated in the Budget Management policy specify that the Committee will meet to consider termly monitoring reports as a minimum (and in some cases monthly may be more appropriate).

After the November 18 Management Committee (where revised budget was considered) no further monitoring report was recorded as presented and discussed until April 19 (relating to the 18/19 outturn and 19/20 start budget). A budget monitoring report was issued for the February 19 meeting but was not presented. There was therefore no minuted scrutiny of the budget position by the Governors during the Spring term 18/19.

It was also noted that the monitoring reports had been requested by Governors in a different format to that produced directly from the PRU’s finance system. This format recorded the funding for the PRU based on the PRU’s claims (rather than funding received) and actual expenditure taken from the finance system. Advanced funding had been provided in April 18 by the LA but this had not been included on these monitoring reports until the actual outturn was reported at year end. This resulted in funding queries being raised by Governors at a late stage.

Assurances were given that the budget position is regularly monitored from the schools finance system by the Head teacher and the School Business Manager however no evidence is retained to confirm this.

An approved 19/20 start budget was required to be submitted to the LA by 10/5/19. The lack of clarity for the Governors concerning funding received and balances due from the LA for 18/19 and an apparent slow response to queries raised with the LA at this time, resulted in delay in approval of a start budget until 4/7/19. At the time of the audit therefore there was no start budget on the PRU’s Finance System and therefore no information had been available to the Governors for the Summer term 19/20.

Recommendation

The school should ensure compliance with the terms of reference included in their Budget Management policy in relation to consideration of termly (or more frequent) monitoring reports by the Management Committee. Effective scrutiny of the budget position should be evidenced in the minutes of the Management Committee.

If monitoring reports are to be presented to the Governors in an alternative format they should include a report produced directly from the schools finance system so the accuracy of balances reported can be confirmed and queries raised if necessary.

Monitoring reports should be regularly produced from the schools finance system and signed by the Headteacher and School Business Manager as evidence of scrutiny.

**Agreed Action 2.1**

The Chair of Governors will ensure that the minutes are an accurate and comprehensive record of the discussions of the budget.

The advised format for reports to Governors will be used from the staffing and finance meeting held 14.11.19.

The Head teacher and SBM have calendared in a monthly meeting to evidence scrutiny of the monitoring reports.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 2 | Head Teacher/School Business Manager | 30.11.19 | 3 Bank Reconciliations

| Issue/Control Weakness | Risk | |------------------------|------| | Bank reconciliations had not been completed for the current financial year. | Inaccurate or fraudulent payments may not be identified and the balance at the bank may not be effectively managed. |

Findings

Bank reconciliations had not been completed for the current financial year and had been completed irregularly for the previous financial year. These reconciliations are required to be submitted to the LA on a monthly basis.

At the time of the audit the reconciliations for the current year were in the process of being completed. However, the last reconciliation submitted to the LA was for the year end at 31 March 2019.

Recommendation

Monthly bank reconciliations should be completed and any irregularities investigated. The reconciliations should be submitted to the LA as required.

Agreed Action 3.1

Due to capacity issues there had been a delay in completing this work which has now corrected.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 2 | School Business Manager | 31.10.19 | 4 Contracts, Ordering and Purchasing

| Issue/Control Weakness | Risk | |------------------------|------| | Recent works valued at £56K were let by the PRU. Quotations had been obtained but school but no formal quotation opening and recording procedure had been followed. | The procurement process could be subject to challenge. |

Findings

Quotations for works to the car park were originally obtained in 2016. However it was later identified that planning permission was required for these works and issues related to the planning resulted in a number of delays and changes to the project. Once these were agreed, the original contractors were asked to resubmit their quotations. This resulted in only two submissions so a further contractor was invited to quote (who was subsequently awarded the contract). Quotations received were not subject to formal opening procedures and were not opened or recorded together.

Recommendation

Returned quotations should be held securely until after a notified closing date and opened together by two officers. A record of opening should be maintained to confirm these procedures have been properly applied.

Agreed Action 4.1

The minutes of the next governors meeting will record the requirement for quotations to be held securely, opened by two officers. A record of this happening will be maintained.

| Priority | 3 | |----------|---| | Responsible Officer | School Business Manager | | Timescale | 30.11.19 |

## 5 Service Contracts

| Issue/Control Weakness | Risk | |------------------------|------| | There is no up to date schedule of current contractual arrangements at the PRU. | Best value may not be achieved and contracts may be in place that are no longer appropriate. |

### Findings

At the time of the audit there was no complete or up to date schedule of ongoing contracts at the PRU. This document should at minimum record the value of all service contracts, the contract period, and the date of renewal. It should be reviewed annually and used to evidence the scheduling of contracts for retender or market testing.

### Recommendation

The schedule of contracts should be updated and reviewed annually. It is recommended that this schedule is presented to Governors so that they are aware of all the contractual arrangements and that any retendering has been appropriately planned.

### Agreed Action 5.1

The recommendation will be actioned.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | School Business Manager | 31.12.19 | 6 Contractor Insurance

| Issue/Control Weakness | Risk | |------------------------|------| | The PRU did not confirm that contractors directly commissioned to complete works have adequate public liability insurance cover. | The PRU may be liable in the event of an accident. |

Findings

A sample of contractors directly commissioned to complete works, or deliver services, was tested to ensure they had adequate insurance cover. The PRU did not hold a copy of the current insurance certificates.

Recommendation

If the PRU requests a contractor to carry out works or provide services, a copy of their public liability insurance certificates should be retained on file to evidence that they have cover of at least £5 million. If the contractor is used on a regular basis, a system should be in place to ensure the insurance certificate is updated when the expiry date has been reached.

Agreed Action 6.1

We have set up a system to ensure public liability insurance is consistently checked for all directly commissioned contractors at the PRU. This system will also evidence the checks which are already completed for off-site services (e.g., alternative provision) and confirm checks have been completed for contractors procured through Services to Schools.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Assistant School Business Manager | 31.12.19 | 7 Income

| Issue/Control Weakness | Risk | |------------------------|------| | Invoiced charges for PRU pupil places are not always raised promptly. Outstanding invoices have not been regularly reviewed although all had some evidence of follow up in the previous financial year. At the time of audit here was a significant amount of overdue debt recorded in the accounts | The PRU may fail to collect all income due and there may be an inaccurate assessment of the PRU’s financial position. |

Findings

Charges to non maintained schools for pupil places are currently invoiced termly in arrears. Charges raised are agreed with the schools before invoicing. This can result in delays in invoicing which can potentially make charges difficult to recover if they are not paid promptly.

Additionally it was found that debtors have not been regularly reviewed although there was evidence that significant debts (such as the amounts outstanding for the Vale of York) had previously been chased up. At the time of audit the school had approximately £43K in overdue invoices. This included £22.3K of debt outstanding in excess of 12 months for Vale of York Academy. The majority of this related to charges for pupil places provided for the Spring term 16/17 and the Summer term 16/17. It is understood that the Academy is disputing whether liability lies with them or the LA. However investigation subsequent to the audit indicates that charges for Spring Term 16/17 may have already been raised by ICT on Academy conversion of Vale of York (April 17).

Audit was informed that cheques for a further £11.7K of outstanding debt had been issued by the payee but had not been received. Assurances were given that these cheques were to be reissued by the payee.

Recommendation

It is recommended that invoices are raised for pupils place funding as soon as possible after the end of term based on the PRU’s records. Any discrepancies should be adjusted by credit note if necessary.

Charges recorded as outstanding from the Vale of York Academy should be reviewed against charges made by ICT at the time of conversion (April 17). The confirmed total of outstanding charges should be pursued with the Academy.

Overdue invoices should be promptly and routinely followed up. Any disputes should be investigated. If only part of the invoice is disputed, part payment should be requested until the disputed charges are resolved.

Agreed Action 7.1

We will request at the next meeting with CYC and secondary schools (16.10.19) that the

Priority 2 timeline for these charges is changed so that we can move them to a week after the end of term rather than a month (which is the timeframe currently applied).

The receipt of invoiced charges and internal charges are now double-checked against the bank statement and Powersolve statement, and outstanding charges chased immediately. Action will be taken in accordance with the debt management policy (see point 1.1). 8 Recruitment

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | References, requested prior to a job offer being made included questions on health related absences. DBS certificates are held on file for longer than allowable. | Failure to comply with the equalities act 2010 and General Data Protection Regulations (GDPR). |

Findings

A sample recent staff appointments was selected and information held on personal files was reviewed. It was found that references held on file had been obtained before an offer of employment had been made and included questions relating to sickness absence. It is Council policy to only request references containing health related questions after a conditional offer of employment has been made in order to comply with the Equality Act 2010. Additionally, copies of DBS certificates were held on file for longer than the 6 months allowable under GDPR regulations and as stated in the document retention schedule. The PRU informed audit that these are held as some units visited by staff request actual sight of the DBS certificate.

Recommendation

The school should use the pro-forma included in the HR policy for obtaining references prior to making a job offer. This does not include health related questions.

Copies of DBS certificates should be removed from personal files and destroyed in accordance with the document retention schedule. It is recommended that relevant staff are issued with an assurance from the PRU that their DBS has been checked and if necessary are required to hold their own DBS to be taken out on visits.

Agreed Action 8.1

Up-dated reference forms are now in place and in use.

The process of cleansing the DBS certificates from staff files has begun and will be completed by 4.11.19.

The Designated Safeguarding Lead will be writing out to all staff with a statement of assurance for when they are visiting other schools and also to alert them to the possible requirement that they keep their DBS certificates to hand if they are going into other schools to work.

| Priority | 3 | |----------|---| | Responsible Officer | School Business Manager and Designated Safeguarding Lead | | Timescale | 30.11.19 | 9 Payroll

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | Checks of salary and supply charges made through CYC had not been completed for the current financial year. | Payroll errors may not be promptly identified and resolved. |

Findings

At the end of period 3, central payments recorded on the monthly powersolve reports had not been entered onto the PRU’s finance system for the current year and routine checks had not been completed to verify the accuracy of the charges. These included checks of salary and supply charges made through the payroll. Salary details need to be checked promptly to avoid any errors from reoccurring in the following months.

For 18/19 payments made to supply staff had been checked against recorded hours and recorded on a monitoring spreadsheet. These checks had not been evidenced for the current year.

Recommendation

Checks on the accuracy of CYC salaries and supply charges made through the payroll should be completed for the current financial year. These checks should be completed promptly for future payments when reports are received to ensure any issues or errors identified are resolved promptly.

Agreed Action 9.1

We will request additional access to the Orovia system for the School Business Manager and further training so that salaries can be checked and monitored through this system. We are still using the historic system for salary checking.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 2 | School Business Manager | 30.11.19 | 10 Petty Cash

| Issue/Control Weakness | Risk | |------------------------|------| | The school holds a high petty cash balance. The petty cash has been used for expenditure and reimbursements not normally made through the petty cash system. | Petty cash held in schools is vulnerable to being misappropriated. |

Findings

Petty cash should only be used for low cost purchases which cannot be invoiced or are inefficient to charge through the official purchasing system. Petty cash of £500 is held at the PRU and is currently reimbursed at least monthly. It was found that a significant proportion of expenditure is for reimbursement of staff car parking charges and bus fares and the purchase of sandwiches (to replace those previously those no longer available from the PRU due to long term staff absence).

Recommendation

Consideration should be given to lowering the petty cash imprest level. Expenditure through petty cash should be reduced by encouraging staff to reimburse travel and parking costs through the travel claims system. Sandwiches could be purchased through the school meals supplier and wherever possible items should be purchased through the PRU’s official purchasing system.

Agreed Action 10.1

We will take a report to the Governing Body on what petty cash is being used for and how it can be reduced.

Travel and parking costs will be added to staff claim forms subject to approval from the Governing Body. We have emailed staff about this issue and put instructions about staff use of petty cash in the weekly staff bulletin. There will need to be a short consultation with staff about this change of practice.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Assistant School Business Manager | 31.12.19 | 11 Inventory

| Issue/Control Weakness | Risk | |------------------------|------| | The PRU does not maintain inventory records in the required format. | Items which are lost or misappropriated may not be identified. In the event of an insurance claim the school may not have a record of items and the claim may be affected. |

Findings

An annual check of current equipment (and in some cases consumables) had been completed for some departments. However the checks were not completed against a permanent inventory record maintained in the required format but consisted of a list of equipment only. No record of previous checks was retained.

Recommendation

An inventory record should be maintained consisting of items which are valuable portable and desirable and valued over an agreed de-minimus level (below which items are not routinely recorded).

The inventory should be verified on an annual basis (by an officer not involved in the maintenance of the record). A signed (PDF) copy of the verified inventory should be retained as well as the current inventory record and a record should be maintained of the date and officer completing inventory checks.

Disposal of inventory items should be authorised by the Head Teacher (or Governors) in accordance with delegated authority.

The PRU will be sent inventory guidance and an electronic inventory format.

Agreed Action 11.1

This recommendation will be actioned with the Assistant School Business Manager bringing all inventory information into the required format.

| Priority | 3 | |----------|---| | Responsible Officer | Assistant School Business Manager | | Timescale | 31.12.19 | Audit Opinions and Priorities for Actions

Audit Opinions

Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit.

Our overall audit opinion is based on 5 grades of opinion, as set out below.

| Opinion | Assessment of internal control | |--------------------|-------------------------------------------------------------------------------------------------| | High Assurance | Overall, very good management of risk. An effective control environment appears to be in operation. | | Substantial Assurance | Overall, good management of risk with few weaknesses identified. An effective control environment is in operation but there is scope for further improvement in the areas identified. | | Reasonable Assurance | Overall, satisfactory management of risk with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. | | Limited Assurance | Overall, poor management of risk with significant control weaknesses in key areas and major improvements required before an effective control environment will be in operation. | | No Assurance | Overall, there is a fundamental failure in control and risks are not being effectively managed. A number of key areas require substantial improvement to protect the system from error and abuse. |

Priorities for Actions

| Priority | Description | |----------|-----------------------------------------------------------------------------| | Priority 1 | A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. | | Priority 2 | A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. | | Priority 3 | The system objectives are not exposed to significant risk, but the issue merits attention by management. | Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk. Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.